A Decade-Old PostgreSQL Vulnerability Puts Thousands of Companies at Risk
A disturbing discovery has been made in the world of cybersecurity, with a 12-year-old vulnerability in one of the most widely used database systems being exploited by attackers to gain control over entire databases and servers. The flaw, dubbed PostGREShell, affects all versions of PostgreSQL from 9.4 to 18, putting tens of thousands of companies at risk.
PostgreSQL is an open-source relational database system that supports both SQL and JSON queries, making it a go-to choice for large enterprises and smaller organizations alike. Its popularity stems from its flexibility, scalability, and ease of use. However, the recent revelation has left many in the cybersecurity community stunned, as the vulnerability was hiding in plain sight.
Cyera, a cybersecurity firm that discovered the flaw, explains how it works. PostgreSQL uses a replication protocol to synchronize multiple copies of a primary database for backup and recovery purposes. This involves creating a logical replication slot, which is essentially a named output plugin that formats the stream of data being replicated. When an attacker with Replication privileges loads this plugin, they can execute any file on the system, thanks to a missing authorization check in the database’s logical decoding.
The problem lies in how PostgreSQL handles the loading of plugins. The plugin name is passed directly to the loader without validation or sanitization, allowing an attacker to trick the system into loading and executing any file. This vulnerability is particularly insidious because it allows an attacker to become a superuser, granting them access to every table in every database, as well as the ability to execute OS commands, read private keys, and write files to any location the postgres process has access to.
The implications are dire. With PostGREShell, an attacker can gain permanent superuser privileges, effectively taking control of the entire database and server. The plugin can also be used to deploy backdoor mechanisms, enabling connections without passwords, copying itself to a stable location, and registering itself to be re-loaded into every new backend.
Fortunately, PostgreSQL has released patches for versions 18.6, 17.11, 16.15, 15.19, and 14.24. Organizations are advised to update their instances as soon as possible, audit their Replication accounts, and remove the Replication attribute from any account that does not need it.
This vulnerability serves as a stark reminder of the importance of keeping software up-to-date and regularly auditing access controls. While PostgreSQL has been patched, the fact remains that tens of thousands of companies are still at risk unless they take immediate action to address this issue. It is essential for organizations to prioritize cybersecurity and invest in robust security measures to protect themselves against such threats.
In practical terms, users should:
* Immediately update their PostgreSQL instances to the latest patched versions
* Review Replication accounts and remove unnecessary privileges
* Regularly audit access controls to prevent similar vulnerabilities from being exploited
Only by taking these steps can organizations hope to mitigate the risk posed by PostGREShell and ensure the security of their databases and servers.
Source: SecurityWeek — 2026-09-04